doorkeeper 5.0.0 → 5.1.0

data/lib/generators/doorkeeper/previous_refresh_token_generator.rb

@@ -1,13 +1,16 @@
 # frozen_string_literal: true
 
-require 'rails/generators'
-require 'rails/generators/active_record'
+require "rails/generators"
+require "rails/generators/active_record"
 
 module Doorkeeper
+  # Generates migration to add previous refresh token column to the
+  # database for Doorkeeper tables.
+  #
   class PreviousRefreshTokenGenerator < ::Rails::Generators::Base
     include ::Rails::Generators::Migration
-    source_root File.expand_path('templates', __dir__)
-    desc 'Support revoke refresh token on access token use'
+    source_root File.expand_path("templates", __dir__)
+    desc "Support revoke refresh token on access token use"
 
     def self.next_migration_number(path)
       ActiveRecord::Generators::Base.next_migration_number(path)
@@ -16,8 +19,8 @@ module Doorkeeper
     def previous_refresh_token
       if no_previous_refresh_token_column?
         migration_template(
-          'add_previous_refresh_token_to_access_tokens.rb.erb',
-          'db/migrate/add_previous_refresh_token_to_access_tokens.rb'
+          "add_previous_refresh_token_to_access_tokens.rb.erb",
+          "db/migrate/add_previous_refresh_token_to_access_tokens.rb"
         )
       end
     end
@@ -25,9 +28,7 @@ module Doorkeeper
     private
 
     def migration_version
-      if ActiveRecord::VERSION::MAJOR >= 5
-        "[#{ActiveRecord::VERSION::MAJOR}.#{ActiveRecord::VERSION::MINOR}]"
-      end
+      "[#{ActiveRecord::VERSION::MAJOR}.#{ActiveRecord::VERSION::MINOR}]"
     end
 
     def no_previous_refresh_token_column?

data/lib/generators/doorkeeper/templates/initializer.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 Doorkeeper.configure do
   # Change the ORM that doorkeeper will use (needs plugins)
   orm :active_record
@@ -47,7 +49,12 @@ Doorkeeper.configure do
   # access_token_expires_in 2.hours
 
   # Assign custom TTL for access tokens. Will be used instead of access_token_expires_in
-  # option if defined. `context` has the following properties available
+  # option if defined. In case the block returns `nil` value Doorkeeper fallbacks to
+  # `access_token_expires_in` configuration option value. If you really need to issue a
+  # non-expiring access token (which is not recommended) then you need to return
+  # Float::INFINITY from this block.
+  #
+  # `context` has the following properties available:
   #
   # `client` - the OAuth client application (see Doorkeeper::OAuth::Client)
   # `grant_type` - the grant type of the request (see Doorkeeper::OAuth)
@@ -64,15 +71,74 @@ Doorkeeper.configure do
 
   # The controller Doorkeeper::ApplicationController inherits from.
   # Defaults to ActionController::Base.
-  # See https://github.com/doorkeeper-gem/doorkeeper#custom-base-controller
+  # See https://doorkeeper.gitbook.io/guides/configuration/other-configurations#custom-base-controller
   #
   # base_controller 'ApplicationController'
 
-  # Reuse access token for the same resource owner within an application (disabled by default)
+  # Reuse access token for the same resource owner within an application (disabled by default).
+  #
+  # This option protects your application from creating new tokens before old valid one becomes
+  # expired so your database doesn't bloat. Keep in mind that when this option is `on` Doorkeeper
+  # doesn't updates existing token expiration time, it will create a new token instead.
   # Rationale: https://github.com/doorkeeper-gem/doorkeeper/issues/383
   #
+  # You can not enable this option together with +hash_token_secrets+.
+  #
   # reuse_access_token
 
+  # Set a limit for token_reuse if using reuse_access_token option
+  #
+  # This option limits token_reusability to some extent.
+  # If not set then access_token will be reused unless it expires.
+  # Rationale: https://github.com/doorkeeper-gem/doorkeeper/issues/1189
+  #
+  # This option should be a percentage(i.e. (0,100])
+  #
+  # token_reuse_limit 100
+
+  # Hash access and refresh tokens before persisting them.
+  # This will disable the possibility to use +reuse_access_token+
+  # since plain values can no longer be retrieved.
+  #
+  # Note: If you are already a user of doorkeeper and have existing tokens
+  # in your installation, they will be invalid without enabling the additional
+  # setting `fallback_to_plain_secrets` below.
+  #
+  # hash_token_secrets
+  # By default, token secrets will be hashed using the
+  # +Doorkeeper::Hashing::SHA256+ strategy.
+  #
+  # If you wish to use another hashing implementation, you can override
+  # this strategy as follows:
+  #
+  # hash_token_secrets using: '::Doorkeeper::Hashing::MyCustomHashImpl'
+  #
+  # Keep in mind that changing the hashing function will invalidate all existing
+  # secrets, if there are any.
+
+  # Hash application secrets before persisting them.
+  #
+  # hash_application_secrets
+  #
+  # By default, applications will be hashed
+  # with the +Doorkeeper::SecretStoring::SHA256+ strategy.
+  #
+  # If you wish to use bcrypt for application secret hashing, uncomment
+  # this line instead:
+  #
+  # hash_application_secrets using: '::Doorkeeper::SecretStoring::BCrypt'
+
+  # When the above option is enabled,
+  # and a hashed token or secret is not found,
+  # you can allow to fall back to another strategy.
+  # For users upgrading doorkeeper and wishing to enable hashing,
+  # you will probably want to enable the fallback to plain tokens.
+  #
+  # This will ensure that old access tokens and secrets
+  # will remain valid even if the hashing above is enabled.
+  #
+  # fallback_to_plain_secrets
+
   # Issue access tokens with refresh token (disabled by default), you may also
   # pass a block which accepts `context` to customize when to give a refresh
   # token or not. Similar to `custom_access_token_expires_in`, `context` has
@@ -84,16 +150,11 @@ Doorkeeper.configure do
   #
   # use_refresh_token
 
-  # Forbids creating/updating applications with arbitrary scopes that are
-  # not in configuration, i.e. `default_scopes` or `optional_scopes`.
-  # (disabled by default)
-  #
-  # enforce_configured_scopes
-
   # Provide support for an owner to be assigned to each registered application (disabled by default)
   # Optional parameter confirmation: true (default false) if you want to enforce ownership of
   # a registered application
-  # Note: you must also run the rails g doorkeeper:application_owner generator to provide the necessary support
+  # NOTE: you must also run the rails g doorkeeper:application_owner generator
+  # to provide the necessary support
   #
   # enable_application_owner confirmation: false
 
@@ -104,6 +165,21 @@ Doorkeeper.configure do
   # default_scopes  :public
   # optional_scopes :write, :update
 
+  # Define scopes_by_grant_type to restrict only certain scopes for grant_type
+  # By default, all the scopes will be available for all the grant types.
+  #
+  # Keys to this hash should be the name of grant_type and
+  # values should be the array of scopes for that grant type.
+  # Note: scopes should be from configured_scopes(i.e. deafult or optional)
+  #
+  # scopes_by_grant_type password: [:write], client_credentials: [:update]
+
+  # Forbids creating/updating applications with arbitrary scopes that are
+  # not in configuration, i.e. `default_scopes` or `optional_scopes`.
+  # (disabled by default)
+  #
+  # enforce_configured_scopes
+
   # Change the way client credentials are retrieved from the request object.
   # By default it retrieves first from the `HTTP_AUTHORIZATION` header, then
   # falls back to the `:client_id` and `:client_secret` params from the `params` object.
@@ -121,8 +197,10 @@ Doorkeeper.configure do
   # access_token_methods :from_bearer_authorization, :from_access_token_param, :from_bearer_param
 
   # Change the native redirect uri for client apps
-  # When clients register with the following redirect uri, they won't be redirected to any server and the authorization code will be displayed within the provider
-  # The value can be any string. Use nil to disable this feature. When disabled, clients must provide a valid URL
+  # When clients register with the following redirect uri, they won't be redirected to
+  # any server and the authorizationcode will be displayed within the provider
+  # The value can be any string. Use nil to disable this feature. When disabled, clients
+  # must providea valid URL
   # (Similar behaviour: https://developers.google.com/accounts/docs/OAuth2InstalledApp#choosingredirecturi)
   #
   # native_redirect_uri 'urn:ietf:wg:oauth:2.0:oob'
@@ -147,6 +225,53 @@ Doorkeeper.configure do
   #
   # forbid_redirect_uri { |uri| uri.scheme.to_s.downcase == 'javascript' }
 
+  # Allows to set blank redirect URIs for Applications in case Doorkeeper configured
+  # to use URI-less OAuth grant flows like Client Credentials or Resource Owner
+  # Password Credentials. The option is on by default and checks configured grant
+  # types, but you **need** to manually drop `NOT NULL` constraint from `redirect_uri`
+  # column for `oauth_applications` database table.
+  #
+  # You can completely disable this feature with:
+  #
+  # allow_blank_redirect_uri false
+  #
+  # Or you can define your custom check:
+  #
+  # allow_blank_redirect_uri do |grant_flows, client|
+  #   client.superapp?
+  # end
+
+  # Specify how authorization errors should be handled.
+  # By default, doorkeeper renders json errors when access token
+  # is invalid, expired, revoked or has invalid scopes.
+  #
+  # If you want to render error response yourself (i.e. rescue exceptions),
+  # set  handle_auth_errors to `:raise` and rescue Doorkeeper::Errors::InvalidToken
+  # or following specific errors:
+  #
+  #   Doorkeeper::Errors::TokenForbidden, Doorkeeper::Errors::TokenExpired,
+  #   Doorkeeper::Errors::TokenRevoked, Doorkeeper::Errors::TokenUnknown
+  #
+  # handle_auth_errors :raise
+
+  # Customize token introspection response.
+  # Allows to add your own fields to default one that are required by the OAuth spec
+  # for the introspection response. It could be `sub`, `aud` and so on.
+  # This configuration option can be a proc, lambda or any Ruby object responds
+  # to `.call` method and result of it's invocation must be a Hash.
+  #
+  # custom_introspection_response do |token, context|
+  #   {
+  #     "sub": "Z5O3upPC88QrAjx00dis",
+  #     "aud": "https://protected.example.net/resource",
+  #     "username": User.find(token.resource_owner_id).username
+  #   }
+  # end
+  #
+  # or
+  #
+  # custom_introspection_response CustomIntrospectionResponder
+
   # Specify what grant flows are enabled in array of Strings. The valid
   # strings and the flows they enable are:
   #
@@ -177,7 +302,7 @@ Doorkeeper.configure do
   # end
 
   # Hook into Authorization flow in order to implement Single Sign Out
-  # or add ny other functionality.
+  # or add any other functionality.
   #
   # before_successful_authorization do |controller|
   #   Rails.logger.info(params.inspect)

data/lib/generators/doorkeeper/templates/migration.rb.erb

@@ -1,9 +1,13 @@
 class CreateDoorkeeperTables < ActiveRecord::Migration<%= migration_version %>
   def change
     create_table :oauth_applications do |t|
-      t.string  :name,         null: false
-      t.string  :uid,          null: false
-      t.string  :secret,       null: false
+      t.string  :name,    null: false
+      t.string  :uid,     null: false
+      t.string  :secret,  null: false
+
+      # Remove `null: false` if you are planning to use grant flows
+      # that doesn't require redirect URI to be used during authorization
+      # like Client Credentials flow or Resource Owner Password.
       t.text    :redirect_uri, null: false
       t.string  :scopes,       null: false, default: ''
       t.boolean :confidential, null: false, default: true
@@ -13,7 +17,7 @@ class CreateDoorkeeperTables < ActiveRecord::Migration<%= migration_version %>
     add_index :oauth_applications, :uid, unique: true
 
     create_table :oauth_access_grants do |t|
-      t.integer  :resource_owner_id, null: false
+      t.references :resource_owner,  null: false
       t.references :application,     null: false
       t.string   :token,             null: false
       t.integer  :expires_in,        null: false
@@ -31,21 +35,21 @@ class CreateDoorkeeperTables < ActiveRecord::Migration<%= migration_version %>
     )
 
     create_table :oauth_access_tokens do |t|
-      t.integer  :resource_owner_id
-      t.references :application
+      t.references :resource_owner, index: true
+      t.references :application,    null: false
 
       # If you use a custom token generator you may need to change this column
       # from string to text, so that it accepts tokens larger than 255
       # characters. More info on custom token generators in:
       # https://github.com/doorkeeper-gem/doorkeeper/tree/v3.0.0.rc1#custom-access-token-generator
       #
-      # t.text     :token,             null: false
-      t.string   :token,                  null: false
+      # t.text :token, null: false
+      t.string :token, null: false
 
       t.string   :refresh_token
       t.integer  :expires_in
       t.datetime :revoked_at
-      t.datetime :created_at,             null: false
+      t.datetime :created_at, null: false
       t.string   :scopes
 
       # If there is a previous_refresh_token column,
@@ -58,12 +62,15 @@ class CreateDoorkeeperTables < ActiveRecord::Migration<%= migration_version %>
     end
 
     add_index :oauth_access_tokens, :token, unique: true
-    add_index :oauth_access_tokens, :resource_owner_id
     add_index :oauth_access_tokens, :refresh_token, unique: true
     add_foreign_key(
       :oauth_access_tokens,
       :oauth_applications,
       column: :application_id
     )
+
+    # Uncomment below to ensure a valid reference to the resource owner's table
+    # add_foreign_key :oauth_access_grants, <model>, column: :resource_owner_id
+    # add_foreign_key :oauth_access_tokens, <model>, column: :resource_owner_id
   end
 end

data/lib/generators/doorkeeper/views_generator.rb

@@ -2,14 +2,16 @@
 
 module Doorkeeper
   module Generators
+    # Generates doorkeeper views for Rails application
+    #
     class ViewsGenerator < ::Rails::Generators::Base
-      source_root File.expand_path('../../../app/views', __dir__)
+      source_root File.expand_path("../../../app/views", __dir__)
 
-      desc 'Copies default Doorkeeper views and layouts to your application.'
+      desc "Copies default Doorkeeper views and layouts to your application."
 
       def manifest
-        directory 'doorkeeper', 'app/views/doorkeeper'
-        directory 'layouts/doorkeeper', 'app/views/layouts/doorkeeper'
+        directory "doorkeeper", "app/views/doorkeeper"
+        directory "layouts/doorkeeper", "app/views/layouts/doorkeeper"
       end
     end
   end

data/spec/controllers/application_metal_controller_spec.rb

@@ -1,12 +1,16 @@
 # frozen_string_literal: true
 
-require 'spec_helper_integration'
+require "spec_helper_integration"
 
 describe Doorkeeper::ApplicationMetalController do
   controller(Doorkeeper::ApplicationMetalController) do
     def index
       render json: {}, status: 200
     end
+
+    def create
+      render json: {}, status: 200
+    end
   end
 
   it "lazy run hooks" do
@@ -16,35 +20,45 @@ describe Doorkeeper::ApplicationMetalController do
     expect(i).to eq 1
   end
 
-  describe 'enforce_content_type' do
+  describe "enforce_content_type" do
     before { allow(Doorkeeper.configuration).to receive(:enforce_content_type).and_return(flag) }
 
-    context 'enabled' do
+    context "enabled" do
       let(:flag) { true }
 
-      it '200 for the correct media type' do
-        get :index, params: {}, as: :url_encoded_form
+      it "returns a 200 for the requests without body" do
+        get :index, params: {}
         expect(response).to have_http_status 200
       end
 
-      it 'returns a 415 for an incorrect media type' do
-        get :index, as: :json
+      it "returns a 200 for the requests with body and correct media type" do
+        post :create, params: {}, as: :url_encoded_form
+        expect(response).to have_http_status 200
+      end
+
+      it "returns a 415 for the requests with body and incorrect media type" do
+        post :create, params: {}, as: :json
         expect(response).to have_http_status 415
       end
     end
 
-    context 'disabled' do
+    context "disabled" do
       let(:flag) { false }
 
-      it 'returns a 200 for the correct media type' do
+      it "returns a 200 for the correct media type" do
         get :index, as: :url_encoded_form
         expect(response).to have_http_status 200
       end
 
-      it 'returns a 200 for an incorrect media type' do
+      it "returns a 200 for an incorrect media type" do
         get :index, as: :json
         expect(response).to have_http_status 200
       end
+
+      it "returns a 200 for the requests with body and incorrect media type" do
+        post :create, params: {}, as: :json
+        expect(response).to have_http_status 200
+      end
     end
   end
 end

data/spec/controllers/applications_controller_spec.rb

@@ -1,8 +1,10 @@
-require 'spec_helper'
+# frozen_string_literal: true
+
+require "spec_helper"
 
 module Doorkeeper
   describe ApplicationsController do
-    context 'JSON API' do
+    context "JSON API" do
       render_views
 
       before do
@@ -10,81 +12,81 @@ module Doorkeeper
         allow(Doorkeeper.configuration).to receive(:authenticate_admin).and_return(->(*) { true })
       end
 
-      it 'creates an application' do
+      it "creates an application" do
         expect do
           post :create, params: {
-             doorkeeper_application: {
-               name: 'Example',
-               redirect_uri: 'https://example.com'
-             }, format: :json
-           }
-        end.to change { Doorkeeper::Application.count }
+            doorkeeper_application: {
+              name: "Example",
+              redirect_uri: "https://example.com",
+            }, format: :json,
+          }
+        end.to(change { Doorkeeper::Application.count })
 
         expect(response).to be_successful
 
-        expect(json_response).to include('id', 'name', 'uid', 'secret', 'redirect_uri', 'scopes')
+        expect(json_response).to include("id", "name", "uid", "secret", "redirect_uri", "scopes")
 
-        expect(json_response['name']).to eq('Example')
-        expect(json_response['redirect_uri']).to eq('https://example.com')
+        expect(json_response["name"]).to eq("Example")
+        expect(json_response["redirect_uri"]).to eq("https://example.com")
       end
 
-      it 'returns validation errors on wrong create params' do
+      it "returns validation errors on wrong create params" do
         expect do
           post :create, params: {
-             doorkeeper_application: {
-               name: 'Example'
-             }, format: :json
-           }
-        end.not_to change { Doorkeeper::Application.count }
+            doorkeeper_application: {
+              name: "Example",
+            }, format: :json,
+          }
+        end.not_to(change { Doorkeeper::Application.count })
 
         expect(response).to have_http_status(422)
 
-        expect(json_response).to include('errors')
+        expect(json_response).to include("errors")
       end
 
-      it 'returns application info' do
-        application = FactoryBot.create(:application, name: 'Change me')
+      it "returns application info" do
+        application = FactoryBot.create(:application, name: "Change me")
 
         get :show, params: { id: application.id, format: :json }
 
         expect(response).to be_successful
 
-        expect(json_response).to include('id', 'name', 'uid', 'secret', 'redirect_uri', 'scopes')
+        expect(json_response).to include("id", "name", "uid", "secret", "redirect_uri", "scopes")
       end
 
-      it 'updates application' do
-        application = FactoryBot.create(:application, name: 'Change me')
+      it "updates application" do
+        application = FactoryBot.create(:application, name: "Change me")
 
         put :update, params: {
           id: application.id,
           doorkeeper_application: {
-            name: 'Example App',
-            redirect_uri: 'https://example.com'
-          }, format: :json
+            name: "Example App",
+            redirect_uri: "https://example.com",
+          }, format: :json,
         }
 
-        expect(application.reload.name).to eq 'Example App'
+        expect(application.reload.name).to eq "Example App"
 
-        expect(json_response).to include('id', 'name', 'uid', 'secret', 'redirect_uri', 'scopes')
+        expect(json_response).to include("id", "name", "uid", "secret", "redirect_uri", "scopes")
       end
 
-      it 'returns validation errors on wrong update params' do
-        application = FactoryBot.create(:application, name: 'Change me')
+      it "returns validation errors on wrong update params" do
+        application = FactoryBot.create(:application, name: "Change me")
 
         put :update, params: {
           id: application.id,
           doorkeeper_application: {
-            name: 'Example App',
-            redirect_uri: 'localhost:3000'
-          }, format: :json
+            name: "Example App",
+            redirect_uri: "localhost:3000",
+          }, format: :json,
         }
 
         expect(response).to have_http_status(422)
 
-        expect(json_response).to include('errors')
+        expect(json_response).to include("errors")
       end
 
-      it 'destroys an application' do
+      it "destroys an application" do
         application = FactoryBot.create(:application)
 
         delete :destroy, params: { id: application.id, format: :json }
@@ -94,39 +96,38 @@ module Doorkeeper
       end
     end
 
-    context 'when admin is not authenticated' do
+    context "when admin is not authenticated" do
       before do
         allow(Doorkeeper.configuration).to receive(:authenticate_admin).and_return(proc do
           redirect_to main_app.root_url
         end)
       end
 
-      it 'redirects as set in Doorkeeper.authenticate_admin' do
+      it "redirects as set in Doorkeeper.authenticate_admin" do
         get :index
         expect(response).to redirect_to(controller.main_app.root_url)
       end
 
-      it 'does not create application' do
+      it "does not create application" do
         expect do
-          post :create,
-               params: {
-                 doorkeeper_application: {
-                   name: 'Example',
-                   redirect_uri: 'https://example.com'
-                 }
-               }
-        end.not_to change { Doorkeeper::Application.count }
+          post :create, params: {
+            doorkeeper_application: {
+              name: "Example",
+              redirect_uri: "https://example.com",
+            },
+          }
+        end.not_to(change { Doorkeeper::Application.count })
       end
     end
 
-    context 'when admin is authenticated' do
+    context "when admin is authenticated" do
       render_views
 
       before do
         allow(Doorkeeper.configuration).to receive(:authenticate_admin).and_return(->(*) { true })
       end
 
-      it 'sorts applications by created_at' do
+      it "sorts applications by created_at" do
         first_application = FactoryBot.create(:application)
         second_application = FactoryBot.create(:application)
         expect(Doorkeeper::Application).to receive(:ordered_by).and_call_original
@@ -137,45 +138,42 @@ module Doorkeeper
         expect(response.body).to have_selector("tbody tr:last-child#application_#{second_application.id}")
       end
 
-      it 'creates application' do
+      it "creates application" do
         expect do
-          post :create,
-               params: {
-                 doorkeeper_application: {
-                   name: 'Example',
-                   redirect_uri: 'https://example.com'
-                 }
-               }
+          post :create, params: {
+            doorkeeper_application: {
+              name: "Example",
+              redirect_uri: "https://example.com",
+            },
+          }
         end.to change { Doorkeeper::Application.count }.by(1)
 
         expect(response).to be_redirect
       end
 
-      it 'does not allow mass assignment of uid or secret' do
+      it "does not allow mass assignment of uid or secret" do
         application = FactoryBot.create(:application)
-        put :update,
-            params: {
-              id: application.id,
-              doorkeeper_application: {
-                uid: '1A2B3C4D',
-                secret: '1A2B3C4D'
-              }
-            }
-
-        expect(application.reload.uid).not_to eq '1A2B3C4D'
+        put :update, params: {
+          id: application.id,
+          doorkeeper_application: {
+            uid: "1A2B3C4D",
+            secret: "1A2B3C4D",
+          },
+        }
+
+        expect(application.reload.uid).not_to eq "1A2B3C4D"
       end
 
-      it 'updates application' do
+      it "updates application" do
         application = FactoryBot.create(:application)
-        put :update,
-            params: {
-              id: application.id, doorkeeper_application: {
-                name: 'Example',
-                redirect_uri: 'https://example.com'
-              }
-            }
-
-        expect(application.reload.name).to eq 'Example'
+        put :update, params: {
+          id: application.id, doorkeeper_application: {
+            name: "Example",
+            redirect_uri: "https://example.com",
+          },
+        }
+
+        expect(application.reload.name).to eq "Example"
       end
     end
   end